IT Support Companies near you

The Essential Eight is ASD's baseline: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. It is not a law and there is no certificate at the end of it, but it is the reference point Australian organisations and insurers keep coming back to, and it was designed for exactly the internet-connected office networks that small and medium businesses run.

Four of the eight are day-to-day managed service work. Patching cadence, who has standing administrator rights, whether multi-factor authentication is enforced on every account rather than offered, and whether backups are tested by restoring something rather than by looking at a green tick. The other four, particularly application control and macro restrictions, are harder and often need a project rather than a monthly fee, so they get quietly skipped.

ASD says the eight strategies were designed to complement each other, and that organisations should plan to reach the same maturity level across all eight before moving to a higher level. That matters when you read a provider's proposal: a single strong control next to seven weak ones is not a baseline, it is a talking point.

Almost every managed service agreement promises a response time. Very few promise a resolution time, and the difference is where most disappointment lives. A one-hour response means somebody acknowledges the ticket within an hour. It does not mean your server is back. Read the priority table: what counts as priority one, who decides the priority, and whether a whole office being offline is automatically treated as critical.

Check the coverage window against how your business actually works. Business hours support written as eight to six on weekdays is a problem for a warehouse that starts at five, or a clinic that runs Saturday mornings. After-hours cover is usually a separate rate or a separate retainer, and the callout minimum can be larger than the job.

Ask what happens when the service level is missed. Many agreements attach no consequence at all, which is worth knowing before you sign rather than during an outage. Ask, too, whether service level reporting is produced automatically from the ticket system or assembled by hand, because hand-assembled numbers tend to improve.

The single most important technical question in an IT support relationship is who controls the identity platform. In a Microsoft 365 environment that means the global administrator accounts and the tenant itself; in Google Workspace it means the super administrator. If those accounts exist only inside the provider's own management tenant, you are dependent on their cooperation to do anything, including leave.

The workable arrangement is that the tenant, the domain registration and the billing relationship sit in your business name, the provider holds delegated administrative access under named accounts, and at least one break-glass administrator account exists that you control and that is not used day to day. Credentials for that account should be stored somewhere you can reach without the provider.

This is also a privacy question. APP 11 requires an entity to take reasonable steps to protect the personal information it holds, and the OAIC's guidance treats the use of third party providers, including cloud computing, as one of the areas those reasonable steps cover. Outsourcing the administration does not outsource the obligation, so how many people at the provider hold standing privileged access, and whether that access is logged, is your business.

Managed service agreements are classic standard form contracts: drafted by one side, offered without real negotiation. Since 9 November 2023 it has been banned to propose, use or rely on an unfair term in a standard form contract with a consumer or a small business, with penalties attached, and the small business threshold was widened to a business with fewer than 100 employees or annual turnover under 10 million Australian dollars. That covers the overwhelming majority of firms buying IT support.

The ACCC describes unfair terms as those that let one party avoid or limit their obligations, or vary or end the contract unilaterally, without the other side having the same right. In IT agreements the recurring candidates are automatic renewal for a further long term unless you cancel in a narrow window, unilateral price rises with no exit, and clauses making the provider's documentation unavailable after termination.

Being covered does not void a term automatically; a court decides whether a term is unfair. But the regime gives you a reasonable basis to ask for auto-renewal, variation and exit clauses to be rewritten before you sign, and most providers will move on them.